Judge to Google: sniffing even open WiFi networks may be wiretapping

When a homeowner runs an open, unencrypted wireless network and Google sniffs the packets from that network, has wiretapping taken place? Or did the openness of the network remove the user's reasonable expectation of privacy?

Google's Street View project has enmeshed the company in litigation around the world, most notably over the company's data collection from WiFi networks its camera cars passed while doing their work. (Google has claimed that this was a mistake.) In the US, a host of class-action lawsuits over the practice have been consolidated into a single case, and the California federal judge overseeing it has just refused Google's motion to completely dismiss the case. Sniffing even open WiFi packets might indeed be wiretapping, he ruled.

The case remains at a preliminary stage, but the ruling grapples with an interesting question: the extent to which one can access an open WiFi network without falling afoul of the Wiretap Act. Judge James Ware drew a distinction in yesterday's ruling between merely accessing an open WiFi network and actually sniffing the individual packets on that network.

In the first case, one is only jumping onto a network to send and receive's one own communications; in the second case, one is looking into someone else's communications, and doing so in a way that requires nontrivial technical ability or software.

The key question turns on whether open WiFi packets are "readily accessible to the general public," since US law does provide an exception for monitoring such signals. Because Google's Street View vehicles allegedly collected WiFi network names (SSIDs), unique hardware addresses (MAC addresses), usernames, passwords, and even "whole e-mails," Judge Ware concluded that the plaintiffs had stated a proper Wiretap Act claim.

Google tried to claim the "readily accessible" exception, but the judge called the request "misplaced."

While Plaintiffs plead that their networks, or electronic communications systems, were configured such that the general public may join the network and readily transmit electronic communications across that network to the Internet, Plaintiffs [also] plead that the networks were themselves configured to render the data packets, or electronic communications, unreadable and inaccessible without the use of rare packet sniffing software; technology allegedly outside the purview of the general public. Thus, the Court finds that Plaintiffs plead facts sufficient to support a claim that the Wi-Fi networks were not "readily accessible to the general public."

Running an open WiFi network does not suddenly put all packets on that network into the public sphere—an important reminder for anyone who like to run things like FireSheep down at the local coffee shop.

Judge Ware did dismiss the state-level claims against Google, but the key federal wiretapping portion of the case moves forward.